CVE-2026-113344: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-113344 is a use-after-free vulnerability in the Performance component of Google Chrome that allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. It affects all versions of Google Chrome prior to 156.0.8078.47 on Windows, Mac, and Linux. The vulnerability was reported by Google on September 15, 2026, and patched on October 20, 2026, with the release of Chrome 156.0.8078.47. It carries a CVSS v3.1 base score of 8.8 (High) and is rated Medium severity by Chromium's internal security scale (Chrome Release, Red Hat Advisory).

The vulnerability is classified as CWE-416 (Use After Free) and CWE-825 (Expired Pointer Dereference), rooted in improper memory management within Chrome's Performance component. When a specially crafted HTML page triggers certain operations in this component, a previously freed memory object can be accessed again, leading to memory corruption. Exploitation requires user interaction — specifically, a victim visiting or being redirected to a malicious web page — but requires no authentication or special privileges from the attacker. The bug was tracked internally as Chromium issue #561926123 and was reported by Google's own security team (Chrome Release, Red Hat Bugzilla).

Successful exploitation allows a remote attacker to execute arbitrary code within the Chrome sandbox, potentially enabling further exploitation of sandbox escape vulnerabilities to achieve full system compromise. The CVSS assessment reflects high impacts to confidentiality, integrity, and availability, meaning an attacker could read sensitive browser data, modify browser state, or cause crashes. Because exploitation is confined to the sandbox by default, chaining with a separate sandbox escape would be required for full host-level code execution (Red Hat Advisory, Chrome Release).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat Advisory). The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable and requires user interaction (visiting a malicious page), which reduces the likelihood of mass exploitation (Chrome Release).

Google has released Chrome 156.0.8078.47 (Linux) and 156.0.8078.47/.48 (Windows/Mac) which addresses this vulnerability. Users and administrators should update Google Chrome to version 156.0.8078.47 or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Organizations should also advise users to avoid visiting untrusted websites and consider enforcing browser update policies via enterprise management tools (Chrome Release, Red Hat Bugzilla).